Use Egress NAT Policy to configure IP masquerade in Autopilot clusters

Stay organized with collections Save and categorize content based on your preferences.

This page explains how to configure clusters created in the Google Kubernetes Engine (GKE) Autopilot mode to perform IP masquerade with the Egress NAT Policy. For more information about IP masquerading in GKE Standard mode, see Configure an IP masquerade agent.

Overview

The GKE Egress NAT policy lets you configure the IP masquerade behavior for Autopilot clusters.

GKE supports two automatically generated Egress NAT policies:

  • Managed by GKE that are fixed and are not editable.
  • Default policies that are editable.

This page shows you how to edit and deploy an Egress NAT policy by either editing the default policy or by creating an Egress NAT policy. This page also shows you how to delete a created Egress NAT policy.

For more information about Egress NAT policy behavior, see the traffic masquerade behavior for Autopilot clusters.

Before you begin

Before you start, make sure you have performed the following tasks:

  • Enable the Google Kubernetes Engine API.
  • Enable Google Kubernetes Engine API
  • If you want to use the Google Cloud CLI for this task, install and then initialize the gcloud CLI.

Requirements

Using GKE Egress NAT policy requires the following:

  • Cluster in version 1.23.4-gke.1600 or later, or 1.22.7-gke.1500 or later.
  • Cluster in Autopilot mode with GKE Dataplane V2 enabled.

Check Egress NAT policy status

You can check if your cluster is running the Egress NAT policy custom resource definition (CRD) by using the Google Cloud CLI tool:

  1. Get the credentials for your cluster:

    gcloud container clusters get-credentials CLUSTER-NAME
    

    Replace CLUSTER_NAME with the name of the cluster.

  2. Check if the Egress NAT policy is running:

    kubectl get crds egressnatpolicies.networking.gke.io
    

    If the Egress NAT policy is running, then the output is similar to the following:

     NAME                                  CREATED AT
     egressnatpolicies.networking.gke.io   2022-03-16T21:05:43Z
    
  3. Get the list of the created Egress NAT policies:

    kubectl get egressnatpolicies
    

    The output is similar to the following:

      NAME             AGE
      default          44h
      gke-bbfa6c0e-1   44h
    

Edit the existing default policy

GKE supports two automatically generated NAT policies, default policy and managed by GKE policy. The default policy is editable and it configures the default non-masquerade destinations.

To edit the existing default policy, perform the following steps:

  1. Get the credentials for your cluster:

    gcloud container clusters get-credentials CLUSTER_NAME
    

    Replace CLUSTER_NAME with the name of your cluster.

  2. Edit the default Egress NAT policy:

    kubectl edit egressnatpolicies default
    
  3. Add or remove destinations with the NoSNAT action as a cidr attribute in CIDR format.:

      apiVersion: networking.gke.io/v1
      kind: EgressNATPolicy
      metadata:
        name: default
      spec:
        action: NoSNAT
        destinations:
        - cidr:  10.0.0.0/8
        - cidr:  172.16.0.0/12
        - cidr:  192.168.0.0/16
        - cidr:  240.0.0.0/4
        - cidr:  192.0.2.0/24
        - cidr:  198.51.100.0/24
        - cidr:  203.0.113.0/24
        - cidr:  100.64.0.0/10
        - cidr:  198.18.0.0/15
        - cidr:  192.0.0.0/24
        - cidr:  192.88.99.0/24
    

    When packets are sent to these destinations, your cluster does not masquerade IP address sources and preserves source Pod IP addresses.

  4. Verify the edited default policy is deployed by checking the Kubernetes events:

    kubectl get events
    

    The output is similar to the following:

    LAST SEEN   TYPE     REASON           OBJECT                    MESSAGE
    13s         Normal   EnsuringPolicy   egressnatpolicy/default   Ensuring IP masquerade config for policy "default"
    

Deploy a new Egress NAT policy

To add new destinations with the NoSNAT action, you can use one of the following options:

To create a new Egress NAT policy that is not part of the default policy, perform the following steps:

  1. Save the following manifest as egress_nat_policy.yaml:

    kind: EgressNATPolicy
    apiVersion: networking.gke.io/v1
    metadata:
      name: POLICY_NAME
    spec:
      action: NoSNAT
      destinations:
      - cidr: CIDR_1
      - cidr: CIDR_2
    

    Replace the following:

    • POLICY_NAME: the name of your new policy.
    • CIDR_1 and CIDR_2: the IP address ranges in CIDR format. When packets are sent to these destinations, your cluster does not masquerade IP address sources and preserves source Pod IP addresses. If you need more than two CIDRs, add more entries to the destinations list following the same format.
  2. Deploy the new policy:

    kubectl create -f egress_nat_policy.yaml
    
  3. Verify your policy is deployed by checking the Kubernetes events:

    kubectl get events
    

    The output is similar to the following:

    LAST SEEN   TYPE     REASON           OBJECT                              MESSAGE
    13s         Normal   EnsuringPolicy   egressnatpolicy/mypolicy            Ensuring IP masquerade config for policy "mypolicy"
    

Delete an Egress NAT policy

To completely delete an Egress NAT policy, run the following command:

kubectl delete egressnatpolicies POLICY_NAME

Replace POLICY_NAME with the name the policy you want to delete.

What's next